{
  "id": 18912691,
  "title": "The Catalogue Route on Our API Host: 43 Records, 22 Enabled, One Renamed Slug",
  "url": "https://urgent.news/2026/11/08/the-catalogue-route-on-our-api-host-43-records-22-enabled-one-renamed",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-08T10:22:49.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/onepassapps/the-catalogue-route-on-our-api-host-43-records-22-enabled-one-renamed-slug-h9d"
  },
  "original_language": "en",
  "account": "The API host for OnePassApps provides two routes that list the same 43 products: GET /api/products and GET /api/config/feature-flags. Both routes contain identical product information, but the two routes differ on 21 of the 43 product names. The GET /api/products route indicates which products are appEnabled and available, while the GET /api/config/feature-flags route does not establish which products can be accessed. The two sets of data share 22 enabled entries with matching slugs, but the other 21 entries have discrepancies. The public sitemap lists 22 /apps/ routes, with 21 matching the catalogue and one named \"newsflow\" that differs between the two routes. The remaining 21 matching slugs have the same names in both the URL and the API response. The runtime route confirms which two products are in the production launch scope. The API host also has a runtime route that returns different information than the catalogue about which two products are in launch scope. The API host's robots.txt file provides no indication of its API endpoints, and the home page HTML does not mention the API host.",
  "summary": "The Catalogue Route on Our API Host: 43 Records, 22 Enabled, One Renamed Slug I work on OnePassApps, so this is our own product, and every number below was measured on it today with plain HTTPS from a signed-out session: no API key, no cookie, no browser, no session, no writes. The route GET https://api.onepassapps.com/api/products answers 200 with application/json , 15,650 bytes, and…",
  "key_points": [
    "API host lists 43 products across two routes",
    "22 products enabled and matched in both routes",
    "One product slug renamed as \"newsflow\""
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}